eBay Scams Use Good English, Too

One of the comments to my original article said messages from people speaking poor English should be assumed to be a fraud, and that spotting fraud is basically as simple as that.



While that strategy will help one avoid some fraud, it does not permit one to enter a legitimate transaction with non-native English speakers. It also does not protect against attacks that come using good English, like this one:

X-Gmail-Received: 8bc0668f763bd8b5b375a143b754ccbca132c47e
Delivered-To: [my_email_address]
Received: by 10.54.158.8 with SMTP id g8cs39451wre;
        Mon, 19 Jun 2006 16:32:19 -0700 (PDT)
Received: by 10.35.50.9 with SMTP id c9mr8941412pyk;
        Mon, 19 Jun 2006 16:32:19 -0700 (PDT)
Return-Path: <mileaqw3@yahoo.com>
Received: from mx36.sjc.ebay.com (mxpool19.ebay.com [66.135.197.25])
        by mx.gmail.com with ESMTP id w63si924779pyw.2006.06.19.16.32.19;
        Mon, 19 Jun 2006 16:32:19 -0700 (PDT)
Received-SPF: neutral (gmail.com: 66.135.197.25 is neither permitted nor denied by domain of mileaqw3@yahoo.com)
Received: from sjcrow08.sjc.ebay.com (sjcrow08.sjc.ebay.com [10.6.67.61])
 by mx36.sjc.ebay.com (8.13.5/8.13.5) with ESMTP id k5JNWI9B022604
 for <[my_email_address]>; Mon, 19 Jun 2006 16:32:18 -0700
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
 by sjcrow08.sjc.ebay.com (8.11.6/8.11.6) with ESMTP id k5JNWIB11820
 for <[my_email_address]>; Mon, 19 Jun 2006 16:32:18 -0700
Message-Id: <200606192332.k5JNWIB11820@sjcrow08.sjc.ebay.com>
Content-Disposition: inline
Content-Transfer-Encoding: base64
Content-Type: text/plain; charset="ISO-8859-1"
MIME-Version: 1.0
X-Mailer: MIME::Lite 3.01 (F2.72; A1.60; B2.20; Q2.20)
Date: Mon, 19 Jun 2006 23:32:18 UT
From: mileaqw3@yahoo.com
To: [my_email_address]
Subject: =?ISO-8859-1?B?ZUJheSBTZWNvbmQgQ2hh?=
  =?ISO-8859-1?B?bmNlIE9mZmVyIGZvciBJ?=
  =?ISO-8859-1?B?dGVtIDQ2NTAzMzI4MDAg?=
  =?ISO-8859-1?B?LSAyMDA2ICBLYXdhc2Fr?=
  =?ISO-8859-1?B?aSA6IEtMWCAgS0xYIDI1?=
  =?ISO-8859-1?B?MFM=?=
  =?ISO-8859-1?B??=
X-Mailer: Rest Of World Mailer=ROW::EMail

Ck1lc3NhZ2UgZnJvbSBlQmF5IE1lbWJlciBtaWxlYXF3MwoKCkRlYXIgZmxpZ2h0NTUzLCBZb3Ug
ZXhwcmVzc2VkIGludGVyZXN0IGluIGFuIGl0ZW0gdGl0bGVkIDIwMDYgIEthd2FzYWtpIDogS0xY
ICBLTFggMjUwUyAtIEl0ZW0gTnVtYmVyIDQ2NTAzMzI4MDAgYnkgYmlkZGluZywgaG93ZXZlciB0
aGUgYXVjdGlvbiBoYXMgZW5kZWQgd2l0aCBhbm90aGVyIG1lbWJlciBhcyB0aGUgaGlnaCBiaWRk
ZXIuIEluIGNvbXBsaWFuY2Ugd2l0aCBlQmF5IHBvbGljeSwgdGhlIHNlbGxlciBpcyBtYWtpbmcg
dGhpcyBTZWNvbmQgQ2hhbmNlIE9mZmVyIHRvIHlvdSBhdCB5b3VyIGJpZCBwcmljZSBvZiBVUyAk
MSw4MDAuMDAgLiBUaGUgc2VsbGVyIGhhcyBpc3N1ZWQgdGhpcyBTZWNvbmQgQ2hhbmNlIE9mZmVy
IGJlY2F1c2UgaGUgaGFzIGR1cGxpY2F0ZSBpdGVtcyBmb3Igc2FsZSBvciB0aGUgd2lubmluZyBi
aWRkZXIgd2FzIHVuYWJsZSB0byBjb21wbGV0ZSB0aGUgdHJhbnNhY3Rpb24uIElmIHlvdSBhY2Nl
cHQgdGhpcyBvZmZlciwgeW91IHdpbGwgYmUgYWJsZSB0byBleGNoYW5nZSBGZWVkYmFjayB3aXRo
IHRoZSBzZWxsZXIgYW5kIHdpbGwgYmUgZWxpZ2libGUgZm9yIGVCYXkgc2VydmljZXMgYXNzb2Np
YXRlZCB3aXRoIGEgdHJhbnNhY3Rpb24sIHN1Y2ggYXMgZnJhdWQgcHJvdGVjdGlvbi4KCgo9PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KClRoaXMgcmVx
dWVzdCBpcyByZWxhdGVkIHRvIGl0ZW0gIyA0NjUwMzMyODAwLgoKaHR0cDovL3d3dy5lYmF5LnBo
L3ZpSXRlbT9JdGVtSWQ9NDY1MDMzMjgwMAoKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09CgoKTWFya2V0cGxhY2UgU2FmZXR5IFRpcHMgCgpOZXZlciBy
ZXNwb25kIHRvIGFuIHVuc29saWNpdGVkIGVtYWlsIHRoYXQgaW5jbHVkZXMgaW5jZW50aXZlcyB0
byBidXkgb3Igc2VsbCBhbiBpdGVtIG9mZiB0aGUgZUJheSBNYXJrZXRwbGFjZS4gSWYgeW91IGdl
dCBzdWNoIGFuIGVtYWlsLCBwbGVhc2UgcmVwb3J0IGl0IHRvIGVCYXkgYXQgaHR0cDovL3d3dy5l
YmF5LnBoL2hlbHBUU0Zvcm0uCgpOZXZlciBwYXkgZm9yIHlvdXIgZUJheSBpdGVtIHRocm91Z2gg
aW5zdGFudCBjYXNoIHRyYW5zZmVyIHNlcnZpY2VzIHN1Y2ggYXMgV2VzdGVybiBVbmlvbiBvciBN
b25leUdyYW0gLSBzdWNoIHNlcnZpY2VzIG9mZmVyIEludGVybmV0IHNob3BwZXJzIG5vIHByb3Rl
Y3Rpb24gYWdhaW5zdCBmcmF1ZC4KCgo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT0KCgpOb3RlOiBJbW1lZGlhdGVseSBjb250YWN0IFJ1bGVzICZhbXA7
IFNhZmV0eSBodHRwOi8vd3d3LmViYXkucGgvaGVscD9wYWdlPWhlbHBQb2xpY2llcyBpZiBvbmUg
b2YgZUJheSdzIHJ1bGVzIHdlcmUgdmlvbGF0ZWQsIHN1Y2ggYXM6IAoKLSBZb3VyIGNvbnRhY3Qg
aW5mb3JtYXRpb24gd2FzIHVzZWQgZm9yIHB1cnBvc2VzIHVucmVsYXRlZCB0byBlQmF5IGJ1c2lu
ZXNzLCBwdWJsaXNoZWQgb25saW5lIG9yIG9mZmxpbmUsIG9yIHdhcyB1c2VkIGZvciB0aGUgcHVy
cG9zZXMgb2YgaGFyYXNzbWVudC4KCi0gWW91IHJlY2VpdmVkIGNvbnRhY3QgaW5mb3JtYXRpb24g
dGhhdCB5b3UgYmVsaWV2ZSB0byBiZSBlcnJvbmVvdXMuCgpUaGFuayB5b3UgZm9yIHVzaW5nIGVC
YXkhCgpodHRwOi8vd3d3LmViYXkucGgvCg==

As the first article discussed, the Return-Path is wrong for a legitimate Second Chance offer.



The square block of gibberish text is the message payload, base64 encoded. The encoding is probably intended to foil email providers' spam and malicious mail filtering. If so, it's a weak attack since any good mail filter will be capable of base64 decoding and examining the content. In any case, the real eBay does not base64 encode messages, so this is clearly a fake.



The above decodes to the following text in the email client:

Dear [ebay_username], 

You expressed interest in an item titled 2006  Kawasaki : KLX  KLX 250S - Item Number 4650332800 by bidding, however the auction has ended with another member as the high bidder. In compliance with eBay policy, the seller is making this Second Chance Offer to you at your bid price of US $1,800.00 . The seller has issued this Second Chance Offer because he has duplicate items for sale or the winning bidder was unable to complete the transaction. If you accept this offer, you will be able to exchange Feedback with the seller and will be eligible for eBay services associated with a transaction, such as fraud protection.

===================================================

This request is related to item # 4650332800.

http://www.ebay.ph/viItem?ItemId=4650332800

===================================================

Marketplace Safety Tips 

Never respond to an unsolicited email that includes incentives to buy or sell an item off the eBay Marketplace. If you get such an email, please report it to eBay at http://www.ebay.ph/helpTSForm.

Never pay for your eBay item through instant cash transfer services such as Western Union or MoneyGram - such services offer Internet shoppers no protection against fraud.

===================================================

Note: Immediately contact Rules & Safety http://www.ebay.ph/help?page=helpPolicies if one of eBay's rules were violated, such as: 

- Your contact information was used for purposes unrelated to eBay business, published online or offline, or was used for the purposes of harassment.

- You received contact information that you believe to be erroneous.

Thank you for using eBay!

http://www.ebay.ph/

Aside from the bad mail headers, additional problems with the content of the offer give it away as a fake. In order of highlighted material above:

1. The thief did not know my real name, as eBay would if this were a real offer.
   
2. A mistaken space between the price and period at the end of a sentence, and the pound sign and item number.
   
3. Reference to ebay.ph which is the eBay domain for the Phillipines. I don't shop there.
   

I write back, agreeing to pay. The thief replies using a Yahoo mail account from an AOL IP address that, combined with the timestamps in the mail headers and a subpoena for billing records, law enforcement could use to track down an actual person.



There is no foreign accent in this message, so you cannot rely on broken English alone to alert you to bad deals.

Hello,



This is John Mitchell, owner of the bike, writing you my terms of sale in order to complete our deal.

The winner of the auction was unable to follow through with the purchase so I decided to use eBay's Second Chance Offer service to contact the other bidders. You are the first one to answer and the selling price will be your highest bid placed on my listing. This will also include the shipping charges to your address. Yes, I will take care of delivery as I have a cousin which owns a shipping company and he will gladly do me this favor.

The bike is in excellent working condition and with clear title. You will receive all the necessary papers to get the bike registered into your name. You have my word that you won't be dissapointed [sic] in this unit.

As for payment, I would like to let eBay handle the transaction, as I am currently out of the country on the Carribean Islands. I am a scenic photographer and I am working for a new project here. So eBay will be the best solution for the both of us. I need your full name and address and also your eBay user id to start the process with them. They will then email you an electronic invoice for your purchase along with the payment instructions.

I will be waiting for your reply in order to conclude this deal as smooth as possible.
Thank you very much for your time.



Best regards,

John Mitchell

Scenic Photographer

1. Offering you free shipping preys upon the victim's desire to get something for nothing. It also keeps the price set at the amount the victim was last willing to pay. The thief does not want the victim to back out over shipping charges! Of course, if you go back and look at the auction this fraud is referring to, the real seller explicitly states:
   

   winning bidder pays all shipping charges!

   
   
   
2. The thief's general promise that all "necessary papers" will be included tends to show that the thief does not know what the necessary papers are, and is therefore, not the real seller. Different states have different titling requirements. A real seller would say, "this comes with a bill of sale because my state doesn't require titles," or, "the title has already been notarized," something more specific, demonstrating knowledge that a legitimate seller would know.
   
   
3. The claim of being a "scenic photographer" is just misdirection and an attempt to lull the victim into a false sense of security. The fact that the thief's signature at the end of the email includes a job title, but no phone contact information shows again that this is a fraud. Anyone with a "signature" that lists a job title will also list a phone number. Besides, if you're about to spend a few thousand dollars, a real seller would give you his phone number to make sure the sale is completed. Thieves won't because they need to hide in the shadows of the internet.
   
   
4. The reason the thief wants your full name and address is because he wants to dummy up a fake shipping Bill of Lading to make you feel like you are actually going to get the merchandise. The reason he wants your eBay user ID is because he needs to generate a fake invoice from eBay that wouldn't look authentic without referring to your eBay user ID, and at this point, the thief doesn't have that because he doesn't know which victim you are.
   
   
   
   He sent many fake offers to multiple victims through eBay's "Contact Member" feature, which only reveals your user ID to him, and not your email address. When you reply to the first fake offer, the thief has your email email address, but no clue which eBay user ID it is associated with. Of course, if he only sent one fake offer and received an answer, he'd know the eBay user ID, but these thieves don't work that slowly. This fraud is taking place on a massive scale.
   

I reply to this message, providing a fictitious name, address and eBay ID. I confirm my last bid amount, intentionally supplying the wrong amount. His reply, by Yahoo Mail from another AOL IP address:

Ok,
you will receive the payment instructions from eBay first thing tomorrow morning.
please get back to me as soon as you hear from them.
Thank you.

As promised, the next morning, I receive this forgery:

X-Gmail-Received: 61bfa50c689e879991fa8974e1c9b24bd9771fcc
Delivered-To: [my_email_address]
Received: by 10.54.158.8 with SMTP id g8cs1138wre;
        Thu, 22 Jun 2006 06:53:33 -0700 (PDT)
Received: by 10.37.18.36 with SMTP id v36mr2024819nzi;
        Thu, 22 Jun 2006 06:53:33 -0700 (PDT)
Return-Path: <escrow@ebay.com>
Received: from mbe0.msomt.modwest.com (mbe0.msomt.modwest.com [216.220.25.82])
        by mx.gmail.com with ESMTP id 40si955960nzf.2006.06.22.06.53.32;
        Thu, 22 Jun 2006 06:53:33 -0700 (PDT)
Received-SPF: softfail (gmail.com: domain of transitioning escrow@ebay.com does not designate 216.220.25.82 as permitted sender)
Received: from findnot.com (mail.findnot.com [202.157.176.101])
 (using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits))
 (No client certificate requested)
 by mbe0.msomt.modwest.com (Postfix) with ESMTP id 12B26D9057C
 for <[my_email_address]>; Thu, 22 Jun 2006 07:53:13 -0600 (MDT)
Received: from findnot.com (findnot.com [127.0.0.1])
 by findnot.com (8.12.11/8.12.11) with ESMTP id k5MDu3FS010458;
 Thu, 22 Jun 2006 09:56:05 -0400
From: "eBay Escrow Service" 
To: [my_email_address]
Cc: mileaqw3@yahoo.com
Subject: Invoice for your eBay item #4650332800
Date: Thu, 22 Jun 2006 09:55:54 -0400
Message-Id: <20060622134740.M92493@findnot.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
 boundary="----=OPENWEBMAIL_ATT_0.141870155780449"

Looking only at the mail headers, the email is clearly a fraud. Although the Return-Path and From fields are nicely forged, the Received headers show that the mail originated from an anonymizing service called findnot.com.



The message portion of this forged email was very sloppy, saying only:

Dear [wrong_ebay_user_id],

Your payment instructions are attached to this message.

Thank you for using our services.

eBay Escrow Team.

The email contained an HTML attachment, which eBay would never send. I viewed it because Gmail will disable any embedded web-bugs and scripting, but normally, you should never open any file attachments unless you asked for them or know what you are doing.



The attached document was an amateurish forgery of an eBay invoice listing the fake Buyer Information that I provided, the wrong price, the thief's false Seller Information, and these instructions:

Please visit your bank and make the payment by wire transfer using the below details of our eBay agent #27:

Account Holder : Joel Rojo
Bank Name : La Salle Bank
Bank address: 68 Stratford Drive, Bloomingdale, IL, 60108
Checking Account #: 5308953453
Bank Routing #: 071000505
 
Confirm the payment by sending us the bank payment receipt to:
         Fax Number (312) 276-8546.

This is a real bank and a real account number (the thief needs to be able to retrieve his money!). In order to open a bank account in the U.S., you need to provide quite a bit of identification. Therefore, it would be relatively easy for law enforcement to capture this criminal by serving a subpoena on the bank for his account records.



Sadly, no law enforcement agencies are interested in pursuing this. I contacted the Illinois Attorney General's Office and got no response. I also talked to an FBI agent on the phone who let me know that his agency could not help unless damages exceeded $100,000.



So again, in a case that was even easier to investigate than the original (the trail in that one led to Germany), no law enforcement agency would take any steps to stop and punish this crime. Meanwhile, the thief continues to try to steal from people (perhaps 10, 50, 500 per day) every day.



Considering that it is well within the thief's ability to contact 100 marks per day using robot harvesters, mass mailing, and other computing power, he could have easily approached over 800 people in the week between the time he contacted me and the writing of this article. If just 2% of victims fall for the scheme (I would bet money the rate is much higher), and the average damage is $2,000 then this thief and others like him can collect (800 * 2% * $2,000) over $30,000 per week -- with no resistance from any law enforcement agency!



In just 4 weeks, this thief can crack the FBI's $100,000 minimum, but because he's stealing smaller amounts from many victims, no single victim will get any help from the FBI, which is probably the only agency technically capable of investigating and prosecuting this kind of crime.



EBay does not pursue reports of this kind of abuse, either. More than a week after I sent them a detailed report about how the person who's eBay user with email address "mileaqw3@yahoo.com" was using eBay's "Contact Member" system to perpetrate fraud, that user still has an open eBay account with which to commit these crimes.

Second Chance eBay Scams (Part I)

The Con

Online scammers operate in many ways. All of them are designed to get at your personal and account information so they can steal from you. Sometimes, they take this information by force, through viruses or spyware. Other times, they expect you to just gladly hand it over! One setting where you're likely to do that is with big ticket items from eBay that seem too good to pass up.



I had been watching a dozen Kawasaki KLR250 motorcycle auctions on eBay over a couple of weeks. One in particular looked like a good deal. Nice pictures and lots of accessories. The seller had 405 feedback ratings, 100% positive.



If you're expecting a description of how this auction was a sham or this seller was trying to cheat, that's not what the story is about. This was a perfectly legitimate auction, with a fine seller with a fine reputation. This story is about what happens after the legitimate auction closes, and everyone thinks it's over.



It's about scammers trolling ended eBay auctions, and sending each non-winning bidder a fake "Second Chance" to buy the item. All the while trying to misdirect you into thinking that they are the seller who's feedback you checked out during the auction. This story is about how you can put the pieces together and figure it out, without being a network genius, and without losing a few thousand dollars.



The Offer

I bid on this bike day before it closed, so my eBay ID was harvested from the item's bidding history page. Before the auction closed, 5 different people outbid me. In this scam, all of us except the seller and high bidder are the marks.



Six days after the auction ended, I get a "Second Chance" email offering to sell me the item at my last bid amount. In the excitement of being offered a sweet bike for just a fraction of its value, I almost didn't notice that this email was a forgery. The scam that I'm about to introduce you to involves someone - not the real seller - who sends fake "Second Chance" offers to all the non-winning bidders after the auction closes. The object of the scam is to collect a whole crop of bids by Western Union or wire transfer, and then disappear.



It begins with your receiving what looks like a "Second Chance" email for an item you recently bid on but didn't win. This fake offer is not from the real seller. The real seller doesn't know anything about it. In fact, this particular scam would be over right now if you just asked the real seller whether he/she really sent you a Second Chance offer. You can do that easily, by going back to the eBay website, pulling up the item, and clicking "Contact Seller."



But just for exercise, let's go through all the motions of the scam. All except the last one, where criminals get your money.



The Email

The fake offer arrives through eBay's official Message System, and you'll find it in "My eBay" under "My Messages." This might lull you into reduced vigilance for the rest of the scam, since new SPF / Domainkey anti-spoofing mechanisms (if your mailserver supports them and you look at them) will verify that the message did originate at eBay, plus eBay is always touting how all the legitimate stuff will always be in "My Messages."



The sender of your "Second Chance" is a thief who uses an actual eBay account to send this spoofed offer through the eBay message system. His eBay registration will use the same email address where he wants you to reply to the scam. Otherwise he would have to convince you to reply to an address other than the one automatically generated by the eBay message system, and that would be too suspicious. The email address he uses will be a throwaway, anonymous address easily obtained at Hotmail, Yahoo or similar*.

*All it would take to shine the light of day on the scam at this point would be if eBay's Search Items by Seller form would accept a registered eBay user's email address as an alternative to searching by user ID. The Find a Member page works with both, and so should "Find Items by Seller." If it worked that way, you could easily search for auctions by seller using the email address given to you in the "offer," (where the con-man needs you to reply), and the result would show that the person issuing this "offer" is not the seller of the auction where you were bidding.

Suggested to eBay June 3, 2006, 13:07pm

Since eBay doesn't display the seller's email address until you win an auction, it's not immediately obvious that the person you're talking to is not the seller from the auction. But this fake "Second Chance" email has a link to the auction that you bid in, and the key misdirection of the whole con is perfected when you assume that bike you wanted has any relationship at all to the person sending you this email. It doesn't.



Even if you don't have a "known good" Second Chance offer to compare this one to, there are many ways to spot these fakes and eBay discusses them in its official publications. Real "Second Chance" emails that truly come from eBay will also appear in the "My Messages" section of your eBay account, with the exact subject line, "eBay Second Chance Offer for Item..." When you receive one by email, the mail headers will have a "Return-Path" of "SecondChanceOffer@ebay.com" and a trail showing the message originating on eBay's internet address space.



Legitimate Second Chance Headers

X-Gmail-Received: 9110f2803e9cadb7f2bde3d086718b780d839891
Delivered-To: ME@MY_EMAIL_ADDRESS
Received: by 10.70.54.2 with SMTP id c2cs613637wxa;
        Sun, 21 May 2006 02:00:44 -0700 (PDT)
Received: by 10.35.66.13 with SMTP id t13mr2998052pyk;
        Sun, 21 May 2006 02:00:44 -0700 (PDT)
Return-Path: <SecondChanceOffer@ebay.com>
Received: from mx16.sjc.ebay.com (mxpool08.ebay.com [66.135.197.14])
        by mx.gmail.com with ESMTP id k62si633282pyk.2006.05.21.02.00.43;
        Sun, 21 May 2006 02:00:44 -0700 (PDT)
Received-SPF: pass (gmail.com: domain of SecondChanceOffer@ebay.com designates 66.135.197.14 as permitted sender)
DomainKey-Status: good (test mode)
Received: from sj-wsyi221 (sj-wsyi221.sjc.ebay.com [10.11.91.32])
 by mx16.sjc.ebay.com (8.13.5/8.13.5) with ESMTP id k4L90hW6009393
 for <ME@MY_EMAIL_ADDRESS>; Sun, 21 May 2006 02:00:43 -0700
DomainKey-Signature: a=rsa-sha1; s=dk; d=ebay.com; c=nofws; q=dns;
 h=message-id:from:reply-to:to:subject:mime-version:
 content-type:x-ebay-mailtracker;
 b=mPi/egMTt99owdLepuzPZlZtnUDu4SrYNyCE0+Wl0vgEFYHZNBaSAO3MnHcQHDkRd
 4ajZR93oVRV4Md9y8GAXukxLkVIVrSb7PRsk/Kj5mPuUn0zI8m5886kz42D7zKctOMf
 K+4Jqj07zCVSCKN6/sVwmxK9HM1xhFY5//+urps=
Date: Sun, 21 May 2006 02:00:43 -0700
Message-ID: <1806957536.1148202043441.JavaMail.ebayapp@sj-wsyi221>
From: eBay 

Reply-To: SecondChanceOffer@ebay.com
To: ME@MY_EMAIL_ADDRESS
Subject: eBay Second Chance Offer for Item #9730021438: Palm Treo 700w/Treo 700 Verizon Like New, Barely Use
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary=1978973166.1148202042879.JavaMail.ebayapp.sj-wsyi221
X-eBay-MailTracker: 10039.461.0.64355

--1978973166.1148202042879.JavaMail.ebayapp.sj-wsyi221
Content-Type: text/plain;charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

----------------------------------------------------------------------
eBay sent this message to MY_REAL_NAME (MY_EBAY_ID).=20
Your registered name is included to show this message originated from eBay.=
=20
Learn more: http://pages.ebay.com/help/confidence/name-userid-emails.html

When tracing a message's path through the internet with mail headers, disregard the first few lines listing traffic on networks whose IPs begin with 10., or 192.168., or 172.16-31, or 169.254. Addresses in that space are known as "private class" networks. They are not routable over the internet and only explain the mail bouncing around a private network either before or after travelling across the internet.



As in the above headers, when a mail actually originates at eBay, the first publicly routable IP address in the mail header will belong to eBay. When verifying this, don't just take the "resolved" domain name in the header for granted. Actually do an nslookup on the IP to make sure it resolves back to something under ebay.com.



If the Return-Path in the headers is "SecondChanceOffer@ebay.com" AND the 1st public class network listed in the mail headers belongs to eBay, then there's a pretty good chance this is a legitimate email. Mind you, a fraudulent message (like the one I received) can also be sent through the eBay message system, but those will contain a different Return-Path header of "member@ebay.com."



Please don't bank on Return-Path or other header information, though. If in doubt, just forward the message along with the original headers to spoof@ebay.com. They'll reply within an hour and tell you whether the message is forged or not. (Make sure you don't fall for any spoofed confirmations of legitimacy!) Still, even without looking at headers, there are many other clues to alert you. Read on.



Evaluating Authenticity

When you receive an officially sanctioned message, eBay will use your real name at the beginning of the message, "eBay sent this message to YOUR_REAL_NAME (your_ebay_id)." They know your name because you gave it to them when you signed up. A scammer is not going to know your real name at this stage of the scheme, hence, it is not included in your shiny fake Second Chance email.



Real eBay messages also contain warnings and URLs with information to help you avoid falling for spoof emails. Forged ones usually don't. Real ones offer you a link to "Buy it Now" that will take you back to the eBay website where you buy the item through PayPal or another standard/somewhat-safe method. Fake ones ask you to buy by "replying" to email and eventually broach the topic of Western Union and wire transfers.



Real ones will have no errors in the message body. The fake one I got had an extra space between a period and the end of a sentence:

"buy this item or contact seller at wurrammnd@hotmail.com ."

Even without any of the above indicators, we still have plenty more carelessness, errors and inconsistencies warning us this deal is a fraud. All my correspondence from this "Frank Vorus" were lousy with them.



Comparing Samples

First, I noticed that the name he used in email to me (Frank Vorus) bore no relation at all to the seller's user ID on eBay. Although a little "off," by itself, not terribly significant. But these criminals are not very bright, and they leave a lot more clues. Take his first personalized message to me:

"I am glad that you are still interested to purchase my item. As is described on the auction the item is full operational and in proper woeking [sic] conditions."

Notice the stilted broken English. That's nothing by itself either, until the writing sample above is compared with the writing style of the original item description, written by the real seller. The real seller's writing wasn't perfect, but he was clearly a native English speaker. I also compared writing samples from the several emails I received from "Frank" with the 375 feedback messages that the real seller on eBay had "Left for Others."

"EXCELLENT!!!! AWSOME!!!! GREAT TRANSACTION!!!!"

"despite repeated emails-no reply-no payment-never contacted me-LOSER"

"Very fast. Item was in perfect shape. Wonderful transaction"

"neat little item-perfect for me-fast shipping!!! great ebayer"

"Got the item right away-it's neat"

"quick shipping even from Ausieland-nice guy to do business with"

The feedback / item description were definitely NOT written by the same person now sending me emails. Maybe if Frank went to an American high school and had some practice handing in copied homework, he could have pulled this off.



Frank also kept talking about how he would ship the bike. The scam could get messy if I came to pick it up and pay in person:

"You want to pick it up, but first off [sic] all i need to see the payment details, as eBay instructed us. Once i have the payment details i will deliver the bike to your home address."

Those statements are in direct contradiction with the original item description written by the real seller:

"MUST PAY IN CASH OR MONEY ORDER!!!! MUST PAY WITHIN FOUR(4) DAYS AFTER AUCTION DONE. YOU MUST PICK UP-NO SHIPPING."

The Bait

Criminals often offer gratuitous excuses that ultimately give them away. Happens all the time on COPS™. Here's a good example:

"I asked eBay to send you a Second Chance Offer becuase [sic] the winner had some personal problems with the money and couldn't handle the situation at this time."

That's very understanding of him. A little more information than one would expect.

"If you are still interested to purchase the item is still available for sale and you have the opportunity to purchase this item at your last bid price."

Aside from the broken English inconsistent with the real seller's writing style, my last bid price was only 2/3 of the winning bid. This bike could easily sell for more than the winning bid if it was relisted. Why would it be offered to me at this price? Four other people bid more than I did, in amounts much closer to the winning bid. Wouldn't one of them have jumped at this already? That's the part that is supposed to hook you, preying on the victim's own greed, a deal so good, you can't resist.



Of course, the scam would be over right now if I just asked the winning bidder whether he bought the item, or whether he backed out because there was something wrong with the seller or the item. You can do that by going back to eBay, pulling up the auction, clicking the user ID of the winning bidder, and then clicking "Contact Member."



Building Trust

In Frank's second mail, he also asks me for some basic information - name, address and eBay ID, claiming to need it in order to start an "official eBay transaction." It made no sense to me, but all the information seemed harmless enough. In retrospect, this might have been an attempt to get enough information to break into MY eBay account. Many people use their address or zip code as a password. Another possibility is that he just wanted to list my address as the "Shipping Address" on his upcoming forged invoice to make me feel more comfortable about paying.



Speaking of paying, he closes with:

"You'll also receive important guidelines + instructions from eBay regarding our transaction (please go through them exactly). I'll handle the shipping, so this will be free of charge for you ."

Another telltale mistaken space between the period and end of sentence, indicating that the author of this message is also the author of the earlier one that was supposed to have come from eBay. More good deals to motivate me (free shipping for a 250lb motorcycle?!) and buttering me up to follow "exactly" instructions in the forged email that he'll send to me in a few minutes. Too bad his shipping promises contradict both the item description and my email to him explaining that I'd only buy the bike in person.



Later, he sends another email to shepherd me to the fleecing:

"i [sic] have requested that the details of the transaction to be verified and if everything will be ok then the transaction will be guaranteed. Once guaranteed by ebay, the transaction will be safe for both of us. Please wait for ebay's confirmation that the transaction is ok and please read carefully all the instructions that ebay will send to you. It's very important that we follow the instructions."

Yes, very important we follow the instructions. We don't want our mark accidentally sending money to the wrong thief!



Deconstructing the Payoff

One minute later, a forged email dressed to look like it came from eBay arrives, with the subject:

"You must send payment of US $2,200.00 shortly for your Item"

"Shortly for my item?" EBay copy doesn't sound like that. Return-Path in the mail headers lists "aw-confirm@ebaysecondchance.com." A WHOIS on the domain "ebaysecondchance.com" shows it hosted and registered by 1-and-1 webhosting in Germany. That's what happens when a webhost gives away 3 free years of web hosting plus a free domain name. The first internet routable IP network in the mail headers is burnt-tech.com out of Canada, confirmed with reverse nslookup. Headers also show this guy used the burnt-tech webmail program to send this while online himself from an America Online IP address.



Forged Mail Headers, not from eBay:

X-Gmail-Received: 2bb2b2f0ee468534d60ec4a806ba172f2f9e2dae
Delivered-To: ME@MY_EMAIL_ADDRESS
Received: by 10.70.31.11 with SMTP id e11cs34834wxe;
        Fri, 2 Jun 2006 08:56:54 -0700 (PDT)
Received: by 10.54.94.16 with SMTP id r16mr2041853wrb;
        Fri, 02 Jun 2006 08:56:54 -0700 (PDT)
Return-Path: <aw-confirm@ebaysecondchance.com>
Received: from burntmail.com (burnt-tech.com [66.98.218.53])
        by mx.gmail.com with SMTP id 7si1587200wrh.2006.06.02.08.56.54;
        Fri, 02 Jun 2006 08:56:54 -0700 (PDT)
Received-SPF: neutral (gmail.com: 66.98.218.53 is neither permitted nor denied by best guess record for domain of aw-confirm@ebaysecondchance.com)
Received: (qmail 10171 invoked from network); 2 Jun 2006 15:56:50 -0000
Received: from unknown (HELO burntmail) (127.0.0.1)
  by localhost with SMTP; 2 Jun 2006 15:56:50 -0000
Received: from 172.181.66.214 (unverified [172.181.66.214])
          by burntmail (VisualMail 4.0)
          with WEBMAIL id 10169;
          Fri, 02 Jun 2006 15:56:50 +0000
From: "eBay" 
To: ME@MY_EMAIL_ADDRESS
Importance: Normal
Sensitivity: Normal
Message-ID: 
X-Mailer: Mintersoft VisualMail, Build 4.0.111601
X-Originating-IP: [172.181.66.214]
Date: Fri, 02 Jun 2006 15:56:50 +0000
Organization: m
Subject: You must send payment of US $2,200.00 shortly for your Item #4641831009
MIME-Version: 1.0
Content-Type: multipart/alternative;
        boundary="--=_vm_0011_W634929128_10169_1149263810"

----=_vm_0011_W634929128_10169_1149263810
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable


Second Chance Offer - Buy The Item You Recently Bid On

Dear MY_EBAY_ID, 

Tracking the Perp

The mail headers tell me that the IP address of the computer the perpetrator is using is 172.181.66.214. Nslookup tells me that's an AOL (formerly America Online) IP. But I can also compare the geographic location of his IP with the geographic location of the auction as listed on eBay. When I entered the thief's IP address in GeoIP Lookup, it told me that his approximate physical location was somewhere in Germany. A few other GeoIP lookup services estimated Kansas, Florida and Maryland.



Because of the varying results and inherent inaccuraccy of geographically mapping virtual IP space, I corroborated his location using a different method, traceroute. According to tracking done by Visual Trace, the trail toward his IP leads to Frankfurt, Germany before getting lost behind a firewall.



Either way, the person writing me is likely nowhere close to Tehachapi, California where the shiny red motorcycle is supposed to be. By contrast, GeoIP lookup on the real seller's IP address (taken from headers of email communication I had with him) resolves to the location listed in the auction - Tehachapi, CA.



AOL keeps records of all it's users' logins and the IP addresses assigned to each user during the login period. Since these mail headers have both the perpetrator's AOL IP address and exact timestamps, it would be easy for AOL to come up with the identity of criminals based on their service billing records, and provide this to law enforcement. The problem is that most police don't understand how to investigate and prosecute this kind of computer fraud. Local police would rather refer you to the FBI and the FBI can only be bothered with big, important cases with high dollar amounts. As a result, these kind of criminals are free to attempt their crime as many times as they need to, until they succeed. Consider how that would be if police treated attempted bank robberies the same way.



Recognizing Trouble

The purpose of the final forgery is to persuade me to transfer a couple thousand dollars by Western Union -- a payment method the real eBay specifically warns its customers NOT to use in almost every piece of correspondence they send.



The fraudulent message uses comforting words like "insured", "verified," "protection," "refund," and "in association with eBay Inc." to coax me into compliance. I am supposed to "Pay for the transfer with cash at a local Western Union agent."



And, in case I was wavering, wondering whether or not I should send the money, the scammer targets your desire to get something for nothing -- 50% discount on the wire transfer fee!

"Because the fee to send a Western Union Money Transfer is high, compared to other methods of payment, we have arranged with the seller to compensate for half of this fee (i.e. if it costs you $100.00 to send the payment, take $50.00 from the amount insured and send the balance)."

So many elements of a confidence game manipulate the greed or dishonesty of the victim. So remember the old saying, "You can't cheat an honest man."



Closing the Deal

I write him back to tell him that if I am going to buy anything, it will be in person and only after checking out the quality of the merchandise first. I ask him for his phone number, address, real contact points where even clueless police might be able to pick him up. He doesn't go for it. Instead, he appeals to me to just do "as eBay instructed us," invoking their higher authority. It's a tactic con-men use to exploit the comfort most people take in following rules and doing what they're told.



Before closing this case, I warned the other non-winning bidders of this auction and, even though it's nigh impossible to file a security incident report, I reported the situation to eBay. But eBay is busy, and they are not looking into it.



In fact, 6 days after I emailed multiple detailed complaints to eBay (each one answered by just more dull, canned text by CSRs with different first names), explaining how this person was using an actual eBay account to victimize other users by relaying spoofed messages through the official eBay message system, and despite feel-good assurances by eBay representatives like "Ide,"

"I have reviewed your report and have taken appropriate action in accordance with our policies. Such action may include issuing a warning, a temporary suspension, an indefinite suspension or terminating the membership. Out of concern for our members' privacy, we don't discuss the specifics of the actions we take in these situations."

eBay's Member Search page shows that the perpetrator still has his valid eBay account:

"The email address wurrammnd@hotmail.com is used by a valid eBay member with a feedback score of 0 (0% positive). For privacy purposes, it is eBay's policy that User IDs are not revealed to members who are not involved in current or recent transactions with each other."

While I am stuck in a feedback loop with eBay's robot employees, this con-artist keeps his eBay account, and no organized countermeasures are mustered against him. He has been free to run the same scam hundreds more times since my first report to eBay's security group.



If this particular thief ultimately succeeds in stealing someone's money, a good lawyer could make a great case that eBay is negligent for failing to revoke the fraudulent account after having notice of it, and that eBay should be held liable for the damage.



Vigilance

These crooks will always be able to vary slightly from the outline presented here, but they will always make mistakes that give themselves away. They're not that smart. If they were, they wouldn't have to be criminals.



For the volume of confidence scams connected to eBay, the ironic slogan, "bid with confidence" is certainly appropriate.